OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL
A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer’s Windows or WSL machine when the developer signed in, The Hacker News reports. OpenCode connects to MCP (Model Context Protocol) servers to add outside tools, and such code would run with the developer’s own access; Anomaly fixed the flaw in version 1.18.33. https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html
The Hacker NewsOpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSLA patched OpenCode flaw could let malicious MCP servers execute code on Windows and WSL when developers initiated OAuth sign-in.